netdev - Re: [PATCH v2] gre: Avoid kernel panic by clearing IPCB before dst_link

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 17 Feb 2016 16:31:52 -0500 (EST)
From:	David Miller <davem@...emloft.net>
To:	bernie.harris@...iedtelesis.co.nz
Cc:	netdev@...r.kernel.org, kuznet@....inr.ac.ru,
	stable@...r.kernel.org
Subject: Re: [PATCH v2] gre: Avoid kernel panic by clearing IPCB before
 dst_link_failure called

From: Bernie Harris <bernie.harris@...iedtelesis.co.nz>
Date: Tue, 16 Feb 2016 14:10:16 +1300

> skb->cb may contain data from previous layers (in the observed case the
> qdisc layer). In the observed scenario, the data was misinterpreted as
> ip header options, which later caused the ihl to be set to an invalid
> value (<5). This resulted in an infinite loop in the mips implementation
> of ip_fast_csum.
> 
> This patch clears IPCB before dst_link_failure is called from the functions
> ip_tunnel_xmit and ip6gre_xmit2, similar to what commit 11c21a30 does for
> an ipv4 case.
> 
> Signed-off-by: Bernie Harris <bernie.harris@...iedtelesis.co.nz>

Again, I want to see this implemented in a way which causes things to be
treated consistently across all tunneling types.

Which means fixing the exact problem, IPCB(skb)->opt needing initilization.

Thanks.